CVE-2024-37370 Other in n/a
Attackers can truncate GSS wrap tokens by modifying plaintext fields, potentially bypassing integrity checks in applications using MIT Kerberos.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-37370?
CVE-2024-37370 is a high-severity vulnerability in Mit Kerberos 5, published on 28 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.
Weakness: CWE-345
Which versions are affected by CVE-2024-37370?
It affects 1 product.
Products include Mit Kerberos 5.
How do I fix CVE-2024-37370?
Upgrade to a fixed version.
Is CVE-2024-37370 being exploited?
There is no known exploitation of CVE-2024-37370 in the wild and no public exploit code.
Other vulnerabilities in Mit Kerberos 5
Sources
Also known as ALPINE-CVE-2024-37370, AZL-42991, AZL-43002, BELL-CVE-2024-37370, CLEANSTART-2024-TH47154, DEBIAN-CVE-2024-37370 and 3 more.